Description
FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, exposes an HTTP server over the LAN interface of affected devices. This interface is vulnerable to unauthenticated arbitrary command injection through the funjsq_access_token parameter. This affects R6230 before 1.1.0.112, R6260 before 1.1.0.88, R7000 before 1.0.11.134, R8900 before 1.0.5.42, R9000 before 1.0.5.42, and XR300 before 1.0.3.72 and Orbi RBR20 before 2.7.2.26, RBR50 before 2.7.4.26, RBS20 before 2.7.2.26, and RBS50 before 2.7.4.26.
CVSS Metrics
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
- Attack Vector
- network
- Complexity
- high
- Privileges
- none
- User Action
- none
- Scope
- unchanged
- Confidentiality
- high
- Integrity
- high
- Availability
- low
- Weaknesses
- CWE-77
Metadata
- Primary Vendor
- NETGEAR
- Published
- 1/28/2026
- Last Modified
- 3/9/2026
- Source
- NIST NVD
- Note: Verify all details with official vendor sources before applying patches.
Affected Products
netgear : rbr20_firmwarenetgear : r6230_firmwarenetgear : r6260_firmwarenetgear : r7000_firmwarenetgear : r8900_firmwarenetgear : r9000_firmwarenetgear : rax120_firmwarenetgear : rax120v2_firmwarenetgear : xr300_firmwarenetgear : rbs20_firmware
AI-Powered Remediation
Generate remediation guidance or a C-suite brief for this vulnerability.